Create a pie with a table of two columns

[LauraBre]

Hello,

I have a problem to create a pie. This is my search:

tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NBPANUNITAIRE, sum(nb_pan_greaterthanone) AS NBPANMASSE

I'm not able to create a pie with a part NBPANUNITAIRE and a part NBPANMASSSE. It takes only the Nb_PAN_UNITAIRE values. I think that it's because there are two columns in my table and to do a pie we have to do only one column no???? How can I resolve this problem???

Thanks for your answer.

[lguinn2 · Accepted solution]

Try this

tag::source="TokenizerWatchdogSplunk"| 
eval series=case(Nb_PAN==1, "NBPANUNITAIRE", Nb_PAN>1, "NBPANMASSE", Nb_PAN<1, "Other") |
stats sum(Nb_PAN) by series

[LauraBre]

Thanks very much. Your answer is very good. My problem is resolved.

Thanks

[Ayn]

Use transpose:

tag::source="TokenizerWatchdogSplunk"| eval nb_pan_greaterthanone=if(Nb_PAN>1,Nb_PAN,0) | stats count(eval(Nb_PAN=1)) AS NBPANUNITAIRE, sum(nb_pan_greaterthanone) AS NBPANMASSE | transpose

[LauraBre]

The answer of Iguinn resolved my problem. The name of the column was present in the information when I moved the mouse over. Thanks very much for your answer.

[Ayn]

That column will not be used when creating the pie chart, so it shouldn't be a problem I think?

[LauraBre]

Thanks, I do it, it's perfect. But now, I search how can I rename the name of the column because I have a column named row1 and I want to change her name.

Thanks for your answer.